cve-2025-25973

gistfile1.txt

[CVE-ID]
cve-2025-25973

[PRODUCT]
PPress v0.0.9

[TYPE]
Stored XSS

[DESCRIPTION]
A stored xss vulnerability exists in the related recommendations feature, where title, category, tags can all trigger stored xss

[DETAILS]
A stored Cross-Site Scripting (XSS) vulnerability has been identified in the "related recommendations" feature of the affected application. The vulnerability allows attackers to inject malicious scripts via the article.title, article.category, and article.tags parameters. These scripts are stored persistently and executed when users interact with the compromised recommendations, leading to arbitrary code execution in the victim’s browser.
Root Cause: The render_recommendations function in the init.py code of article_recommender is defined by Markup(render_template_string(template)) and{% if render_recommendations is defined %}{{ render_recommendations()|safe }}{% endif %}rendering recommendations.html to article.html, the renderArticleCard in the recommendations.js code will display article.tags, article.category and article. title, these three variables lead to stored xss, which will be triggered when these three parameters are malicious payloads in the related recommendations article

[Mitigation & Fix Recommendations]
1.Input Validation & Sanitization:
Sanitize title, category, and tags fields on input (e.g., strip HTML tags, enforce character whitelists).
2.Output Encoding:
Replace |safe with context-aware escaping (e.g., Flask’s autoescape=True, Jinja2 {{ variable | e }}).
Ensure renderArticleCard in JavaScript encodes dynamic content using textContent or innerText instead of innerHTML.
3.Content Security Policy (CSP):
Implement a strict CSP header to block inline scripts (unsafe-inline).

[MORE]
https://github.com/yandaozi/PPress/issues/4